The Linux kernel’s btrfs subsystem contains a bug in the scrub_print_warning_inode() function. When the helper paths_from_inode() fails during path resolution, the function jumps to an error handler without releasing a reference that was previously taken by btrfs_get_fs_root(). This results in a persistent reference count for the filesystem root, reflecting a CWE-911 issue of improper resource handling. Over time, the buildup of unreleased references can exhaust kernel resources, creating memory pressure and the potential for denial of service. No other error pathways release the reference, so the leak is selective and depends on the occurrence of path resolution failures during scrub warnings.

The vulnerability affects the Linux kernel with the btrfs file system. All current or future kernel releases that include the unpatched code in scrub_print_warning_inode() and that use btrfs are potentially impacted, regardless of specific version numbers.

The CVSS score of 1.9 and an EPSS score of less than 1% indicate a low overall risk score, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged system interaction that triggers scrub operations or produces path resolution failures during scrub warnings. Although resource exhaustion could occur if the leak is repeatedly triggered, exploitation requires kernel-level access or compromise and no public exploits are known. The risk is considered moderate in environments where repeated scrub failures could be induced.